Please stop exposing your home server to the internet (do this instead)

Published Aug 8, 2026, 10:15 AM EDT Monica J. White is a journalist with over a decade of experience in covering technology. She built her first PC nearly 20 years ago, and she has since built and tested dozens of PCs. PC hardware is her main beat, and graphics cards and the GPU market at large are her main area of interest, but she has written thousands of articles covering everything related to PCs, laptops, handhelds, and peripherals. From GPUs and CPUs to headsets and software, Monica's always willing to geek out over all things related to computing. Outside of her work with How-To Geek, Monica contributes to TechRadar, PC Gamer, Tom's Guide, Laptop Mag, SlashGear, Whop, and Digital Trends, among others. Her ultimate goal is to make PC gaming and computing approachable and fun to any audience. Monica spends a lot of time elbow-deep in her PC case, as she's always making upgrades, testing something, or plotting out her next build. She's the go-to tech support person in her immediate circle, so she's never out of things to do. Whenever she has spare time, you'll find her gaming until the early hours and hanging out with her dog. The whole point of running a home server is being able to reach your files, media, dashboards, and other self-hosted services whenever you need them. Unfortunately, the easiest way to use remote access is also the riskiest one: through port forwarding. But does remote access need to equal exposing your most vulnerable files to the internet at large? Port forwarding turns a private service into a public one That obscure port number isn't as secret as you think Port forwarding, port forwarding ... What is it exactly? It's one of the simplest ways to reach a home server from outside your network. You choose a port on your router, point it at the local IP address of your server, and tell the router which internal port should receive the traffic. From then on, anyone who connects to your public IP address on that port is sent straight to the service running inside your home. That could be a Plex server, your NAS login page, Home Assistant, a remote desktop tool ... you get it. It's easy to see why port forwarding sounds good. It's built into nearly every router, it costs nothing, and it often works with applications that were never designed around modern private networking tools. You may also need it when sharing a service with people who can't use a VPN client, or when hosting something that's genuinely meant to be public, like a gaming server. But the problem (because of course there is one) is that your router can't discern between you, your friends, an automated scanner, or someone actively looking for vulnerable servers to exploit. It just says yep, let's go for it, and lets the connection through. That means the application itself becomes responsible for keeping attackers out, and small problems like a weak password become gargantuan as they can let an attacker through. Using an unusual external port can cut down on obvious attempts, but it doesn't make your service entirely invisible; internet-wide scanners test huge ranges of addresses and ports automatically. Once they find your server, they'll keep coming back. A mesh VPN gives you remote access without publishing the server Your approved devices join the same private network Credit: Adam Davidson / How-To Geek The TL;DR so far is that you don't want to expose your server to an endless list of possible attackers (who may find the door wide open). This is where tools like Tailscale come in. Tailscale is a mesh VPN, meaning it creates a private network between your server and the devices you approve, even when they're connected to completely different networks. Alternatives like ZeroTier, NetBird, and a regular WireGuard VPN can do similar jobs, but I'm picking Tailscale here because it's particularly easy to set up and handles the annoying networking parts for you. Install it on your server and, say, your laptop, and both devices join the same private network, known as a tailnet. Tailscale then tries to establish a direct, end-to-end encrypted connection between them without making you port forward or set up a traditional VPN server. Replace the forwarded port without breaking remote access Install Tailscale, test the private route, and close the old one Credit: Patrick Campanale / How-To Geek Let's say you're using Tailscale (I did). Start by installing it on the home server and every device you'll use to reach it remotely. Then, sign in with the same account everywhere. Once they're all part of the same tailnet, Tailscale gives the server a stable private IP address and, with MagicDNS, a readable device name. You can then open the service using that address followed by its usual port, such as homeserver:8096 for Jellyfin. The app itself doesn't move or change ports. You're just finding it through Tailscale's private route instead of your (uncomfortably public) IP address. All done? Not so fast -- don't delete the existing port forwarding rule just yet. First, disconnect your laptop or phone from your home Wi-Fi and confirm that you can still reach the server over mobile data or another outside network (very important). Worked fine? Log in to your router and remove the forwarding rule, along with any matching rule created automatically through UPnP. Finally, test both routes one last time. The service should still work through its Tailscale address, but connecting through your public IP and old forwarded port should lead you nowhere. Don't recreate a flat home network inside Tailscale Limit access to what and who really needs it Credit: Jorge Aguilar / How To Geek Yes, Tailscale closes the door to the wider internet, but that doesn't mean you should trust every device inside your tailnet without any questions. By default, your approved devices may be able to communicate quite freely, which is convenient ... until something goes wrong, that is. Compromised devices still equal a compromised network if you don't limit things at the source. So, use Tailscale's access controls to decide which users and devices can reach the server, then limit them to the services they genuinely need. Your phone might need Jellyfin, for example, but probably doesn't need SSH access or permission to open your server's admin dashboard. No thanks. Be extra careful with subnet routing, which lets Tailscale reach devices across your wider home network even when those devices don't run the app themselves. It can be useful, but advertising your entire LAN can recreate the same flat, overly trusting network you were running away from in the first place. Keep private services private Some services really are meant to be public, such as a website or a game server for people outside your household. Fair enough. But treat them as exceptions instead of the rule, and keep the important stuff behind a mesh VPN to keep your network safe first and foremost.